Kopexa
German GRC and ISMS platform covering ISO 27001, NIS2, TISAX, DORA and GDPR from one control set
Quick Overview
| Company | Kopexa GmbH |
|---|---|
| Category | Compliance Automation Software |
| Headquarters | Kiel, Germany |
| EU Presence | EU (Germany) |
| Data Location | Customer data processed exclusively within the EU; application hosting at OVHcloud (France and Germany) per Kopexa's sub-processor list |
| Open Source | No |
| Pricing | Lite EUR 249 per month per space and Pro EUR 599 per month per space, both on a 12-month contract that renews automatically for 12 months unless cancelled before expiry; Enterprise on request. 14-day free trial on the Pro plan, no credit card. Discounted plans for early-stage startups and non-profits on request. |
| Free Option | 14-day free trial on the Pro plan, no credit card required |
| Replaces | Vanta, Drata, OneTrust |
Detailed Review
Kopexa is a GRC and ISMS platform from Kopexa GmbH in Kiel. Its pitch is a single set of controls and evidence that counts towards several frameworks at once: ISO 27001, NIS2, TISAX, DORA, GDPR and VdS 10000. Around that sit modules for risk management, policies, IT asset management, vendor management, incidents, workforce tasks and data subject requests, all on one data layer, so an auditor can follow a risk to a control to its evidence.
Pricing is published and per space: Lite is EUR 249 a month and Pro EUR 599 a month, both on a 12-month contract that renews automatically, with Enterprise on request. Pro adds control mapping, a framework builder, API and GraphQL access, Azure AD and Microsoft 365 imports and AI enrichment for controls. A 14-day trial on Pro needs no credit card. Compared with Cyberday or Conformio, the entry price is higher, but it covers more frameworks.
Customer data is processed inside the EU, with application hosting at OVHcloud in France and Germany. Be aware that Kopexa's own sub-processor list also names US providers for CDN, payments and email, so ask which ones touch your data. Frameworks are machine-readable via OSCAL, and the KSPEC standard is published on GitHub. Unlike Secfix or Kertos, Kopexa shows no named certification of its own, and it has fewer public customer references.
What Kopexa does well
- Published EUR prices per space
- 14-day Pro trial without credit card
- Six frameworks on one control set
- OSCAL and open KSPEC standard
- German company with full imprint
Where Kopexa falls short
- 12-month contract with auto-renewal
- No own ISO 27001 or SOC 2 certificate claimed
- US sub-processors for CDN, payments and email
- Higher entry price than some small-business tools
Standout feature. Kopexa publishes its compliance checks as an open machine-readable standard, KSPEC, and ships its frameworks in OSCAL.
Pros and Cons
Pros
- Published EUR prices per space
- 14-day Pro trial without credit card
- Six frameworks on one control set
- OSCAL and open KSPEC standard
- German company with full imprint
Cons
- 12-month contract with auto-renewal
- No own ISO 27001 or SOC 2 certificate claimed
- US sub-processors for CDN, payments and email
- Higher entry price than some small-business tools
Alternatives to Kopexa
Frequently Asked Questions
What is Kopexa?
Kopexa is a GRC and ISMS platform from Kopexa GmbH in Kiel. Its pitch is a single set of controls and evidence that counts towards several frameworks at once: ISO 27001, NIS2, TISAX, DORA, GDPR and VdS 10000. Around that sit modules for risk management, policies, IT asset management, vendor management, incidents, workforce tasks and data subject requests, all on one data layer, so an auditor can follow a risk to a control to its evidence.
Where is Kopexa based?
Kopexa operates from Kiel, Germany, which places it under EU (Germany).
What does Kopexa cost?
Lite EUR 249 per month per space and Pro EUR 599 per month per space, both on a 12-month contract that renews automatically for 12 months unless cancelled before expiry; Enterprise on request. 14-day free trial on the Pro plan, no credit card. Discounted plans for early-stage startups and non-profits on request.. 14-day free trial on the Pro plan, no credit card required.
Who is Kopexa best for?
German SMEs with several frameworks to map. Kopexa publishes its compliance checks as an open machine-readable standard, KSPEC, and ships its frameworks in OSCAL.
What are the drawbacks of Kopexa?
12-month contract with auto-renewal. No own ISO 27001 or SOC 2 certificate claimed. US sub-processors for CDN, payments and email. Higher entry price than some small-business tools.
Is Kopexa a good alternative to Vanta?
Kopexa is built as a European alternative to Vanta: German GRC and ISMS platform covering ISO 27001, NIS2, TISAX, DORA and GDPR from one control set. It will not be a like-for-like feature match in every respect, so check the review above for where the two genuinely differ before switching.
How does Kopexa compare to other Compliance Automation Software?
Kopexa is one of several European Compliance Automation Software we cover. It is most often compared with Vanta, Drata, OneTrust.